曲阜师范大学校园通关

• Outcome: Review
• Latest audit: Sep 5, 2026 · 8:02 AM UTC
• Version: 1.0.0

Overview

This campus helper is mostly coherent, but it needs Review because it points users at HTTP login portals and publishes a predictable new-student credential formula.

Review the credential-related guidance before installing. Prefer HTTPS official homepages or verified navigation paths for login, avoid entering passwords on HTTP pages, and treat any default or initial-password formula as sensitive information that should not be broadly reused or shared.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/campus-services.md:23
• Finding: Plaintext HTTP Used for Authentication and SSO Entry Points<![CDATA[ ## Vulnerability Details **File Location**: `references/campus-services.md`, lines 23-25 **Additional Location**: `references/official-links.md`, lines 28-30 **Vulnerability Type**: Plaintext transport for credential-bearing services **Risk Level**: High ### Vulnerable Configuration The documentation identifies the following credential-bearing endpoints: ```text Unified identity authentication: http://ids.qfnu.edu.cn/authserver/ Online service portal: http://ehall.qfnu.edu.cn Academic system SSO: http://zhjw.qfnu.edu.cn/sso.jsp ``` It also instructs users that these services support authentication using student identifiers, passwords, verification codes, and federated sign-in methods. ### Technical Analysis The Skill directs users to authentication and single sign-on services through plaintext HTTP URLs. HTTP does not provide transport confidentiality, server authenticity, or integrity. Unless the service performs a secure redirect before any credentials or session data are transmitted—and users reliably validate that redirect—a network-positioned attacker may intercept or modify the connection. The reviewed project does not establish that these endpoints enforce immediate HTTPS redirection, HSTS, or another mechanism that makes direct HTTP navigation safe. Because the identity service provides access to multiple linked university systems, compromise of its credentials or session state can have a broader effect than compromise of an isolated application. ### Attack Path 1. A user follows one of the HTTP links supplied by the Skill. 2. The user connects through a network accessible to an attacker, such as an untrusted wireless network or compromised local gateway. 3. The attacker intercepts the plaintext request or modifies the HTTP response before a secure connection is established. 4. The attacker presents a spoofed sign-in page, captures credentials, or steals exposed session material. 5. The attacker attempts to access SSO-linked acad ...[truncated 771 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every credential-bearing HTTP URL with a verified HTTPS endpoint. 2. If an HTTPS endpoint cannot be verified, direct users to the university's HTTPS homepage and provide navigation instructions instead of a direct HTTP authentication link. 3. Explicitly warn users not to enter passwords, verification codes, or other credentials on an HTTP page. 4. Ask the service owner to enforce HTTPS-only access, immediate server-side redirects, and HSTS. 5. Confirm that authentication cookies use the `Secure`, `HttpOnly`, and appropriate `SameSite` attributes. 6. Remove obsolete HTTP URLs from both `campus-services.md` and `official-links.md` so the insecure path is not reintroduced elsewhere. 7. Periodically validate all authentication links and document the date and source of verification. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/campus-services.md:134
• Finding: Predictable Initial Account Credentials Derived from Admissions PII<![CDATA[ ## Vulnerability Details **File Location**: `references/campus-services.md`, lines 134-137 **Vulnerability Type**: Predictable default credentials **Risk Level**: High ### Vulnerable Documentation The onboarding guidance discloses the following credential construction: ```text Pre-enrollment username: the student's national identity number Initial password: "qfnu" followed by the student's 14-digit examination number First login: change the password and bind a mobile number ``` ### Technical Analysis The initial username and password are deterministic values derived from admissions-related personally identifiable information. Identity numbers and examination numbers may be present in admission documents, screenshots, shared forms, printed materials, compromised databases, or social-engineering conversations. An attacker who obtains both values can construct the initial credentials without password guessing. Requiring a password change after the first successful login does not protect an account if the attacker logs in before the legitimate student. Publishing the formula in a generally accessible Skill further increases awareness of the credential pattern. The vulnerability primarily originates in the external account-provisioning design, but reproducing the formula in the Skill exposes and normalizes the unsafe mechanism. ### Attack Path 1. The attacker learns that new accounts use a deterministic initial-password formula. 2. The attacker obtains a target student's identity number and examination number through leaked admission material, social engineering, discarded documents, or another source. 3. The attacker constructs the username and initial password according to the documented formula. 4. Before the student completes activation or password rotation, the attacker attempts to sign in. 5. If authentication succeeds, the attacker changes recovery information or the password and accesses services available to the student account. Exploit ...[truncated 649 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the deterministic password formula from the Skill. 2. Refer users to a verified official onboarding notice without reproducing reusable credential patterns. 3. Replace PII-derived defaults with unique, random, single-use activation secrets delivered through a verified channel. 4. Require MFA or verified mobile confirmation before the first authenticated session. 5. Force password rotation before exposing account data or linked applications. 6. Expire unused activation secrets quickly and invalidate them immediately after first use. 7. Apply rate limiting, failed-login lockouts, credential-stuffing detection, and alerts for unusual first-login activity. 8. Prevent recovery information from being changed until the student's identity has been independently verified. 9. Avoid using national identity numbers as publicly inferable usernames where feasible. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gpa.py:54
• Finding: GPA Calculator Accepts Non-Finite Scores and Invalid Credit Values<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gpa.py`, lines 54-65 and 78-98 **Vulnerability Type**: Insufficient numeric input validation **Risk Level**: Medium ### Vulnerable Code ```python def to_gp(score): s = str(score).strip() if s in GRADE_MAP: return GRADE_MAP[s] try: v = float(s) except ValueError: raise ValueError( "..." ) if not (0.0 <= v <= 100.0): raise ValueError("..." % v) return 0.0 if v < 60 else v / 10.0 - 5.0 ``` Credit values are converted without finite-value or positive-range validation: ```python try: float(credit) except ValueError: if i == 0: continue raise ValueError("..." % (credit, i + 1)) rows.append((str(name).strip(), score, float(credit))) ``` ```python rows.append((parts[0].strip(), parts[1].strip(), float(parts[2]))) ``` The accepted values are then used directly in GPA arithmetic: ```python point = gp * credit total_credit += credit total_point += point gpa = total_point / total_credit if total_credit else 0.0 ``` Ellipses above replace localized error-message text only; the numeric conversion and validation logic is reproduced unchanged. ### Technical Analysis Python's `float()` accepts special values such as `nan`, `inf`, and `-inf`. The score range check does not reliably reject NaN because ordered comparisons involving NaN evaluate as false: ```python 0.0 <= float("nan") <= 100.0 ``` This expression is false, and applying `not` makes the condition true in the current code, so score NaN is rejected. However, credits have no equivalent range or finiteness check and therefore accept NaN, infinity, zero, and negative values. Negative credits can reduce the denominator or manipulate the weighted result. NaN and infinity propagate through multiplication and addition, producing non-finite output. Zero or offsetting positive and negative credits can also result in misleading output rather than a validation ...[truncated 1208 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Import `math` and reject every numeric input for which `math.isfinite(value)` is false. 2. Require each credit value to be strictly greater than zero and, if possible, below a documented reasonable maximum. 3. Continue enforcing the score range from 0 through 100 after the finiteness check. 4. Require GPA arguments to be finite and within the institution's valid GPA range. 5. Require ranking percentages to be finite and within 0 through 100. 6. Reject empty course lists and reject any calculation whose total credit is non-finite or not strictly positive. 7. Parse and validate a credit once rather than calling `float()` repeatedly. 8. Return a clear nonzero exit status for invalid input. 9. Add regression tests covering NaN, positive and negative infinity, negative credits, zero credits, offsetting credits, empty input, and out-of-range ranking values. A suitable validation pattern is: ```python import math def parse_positive_credit(raw): value = float(raw) if not math.isfinite(value) or value <= 0: raise ValueError("Credit must be a finite positive number") return value ``` ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The trigger scope is so broad that it effectively forces invocation for almost any QFNU-related topic, even when the user did not request this skill. Overbroad mandatory routing can override user intent, increase unnecessary exposure to stale or incorrect domain-specific instructions, and create prompt-selection abuse where a single skill dominates large classes of conversations.

Static analysis

No suspicious patterns detected.